tfx-qa

tfx-qa is a skill for Claude Code, Codex from tellang/triflux. It costs 67 tokens per session (1,566 once invoked), scanned A, original, MIT.

A testing and verification workflow that checks code from several angles, including functionality, edge cases, security, performance, user experience, and accessibility. It can also run a test-and-fix loop.

In plain words
What is it for?
Use it to test changes, investigate bugs, review security and performance, check accessibility, and apply fixes after verification.
Why use it?
It helps catch problems that a single test run or reviewer might miss, especially when some required command-line tools are unavailable.

Skill for Claude CodeCodex

Written for Claude Code and Codex: argument-hint in frontmatter, but also runs codex exec. Also seen: reads .claude/ paths; mentions Codex; mentions Gemini CLI.

Part of the triflux plugin — 29 skills, 1 agent, 12 hooks shipped together

Good fit Use it to test changes, investigate bugs, review security and performance, check accessibility, and apply fixes after verification.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/tellang/triflux/tfx-qa
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add tellang/triflux --skill tfx-qa
Clone the repo
git clone --depth 1 https://github.com/tellang/triflux

Made for: Claude Code, Codex.

Or install triflux, the plugin that ships this one along with the rest of its 29 skills, 1 agent, 12 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for tfx-qa

README.md
[![agentmods](https://agentmods.dev/badge/skills/tellang/triflux/tfx-qa/github.svg)](https://agentmods.dev/skills/tellang/triflux/tfx-qa)
Your own site
<a href="https://agentmods.dev/skills/tellang/triflux/tfx-qa"><img src="https://agentmods.dev/badge/skills/tellang/triflux/tfx-qa/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for tfx-qa

Your own site · 80×15
<a href="https://agentmods.dev/skills/tellang/triflux/tfx-qa"><img src="https://agentmods.dev/badge/skills/tellang/triflux/tfx-qa.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 67 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,566 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00067 $0.01566
Opus 5 $0.00034 $0.00783
Sonnet 5 $0.00013 $0.00313
Haiku 4.5 $0.00007 $0.00157

Measured 9d ago against content hash 3abdb48a78eb, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

tfx-qa scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -sf http://127.0.0.1:27888/status >/dev/null && \
packages/triflux/skills/tfx-qa/SKILL.md · 163 lines

How it starts

The opening of the file, as written. The whole thing — 163 lines — stays where its author put it; the contents beside it link to each section on GitHub.

tfx-qa — Test & Verification (Deep by Default)

ARGUMENTS 처리: ARGUMENTS 에 --quick 포함 → Quick 모드. 그 외 → Deep 모드 (기본).

AI makes completeness near-free. 기본은 Claude(기능/엣지) + Codex(보안/성능) + Antigravity(UX/접근성) 3-CLI 독립 검증 + 교차검증 + 자동 수정. 빠른 테스트-수정 루프는 --quick.


모드 분기

--quick → Quick 모드 (Codex test-fix 루프). 그 외 → Deep 모드 (기본, 3-CLI consensus + fix).


Deep 모드 (기본)

전제조건 프로브 및 Tier Degradation

진입 즉시 실행. 빈 stdout + exit 0 금지.

psmux --version 2>/dev/null && \
  curl -sf http://127.0.0.1:27888/status >/dev/null && \
  codex --version 2>/dev/null && \
  agy --version 2>/dev/null
Tier 조건 실행 방식
Tier 1 전부 정상 auto multi 3-CLI (tmux/psmux 리드면 interactive)
Tier 2 일부 CLI 가용 CLI + Claude Agent
Tier 3 Hub 또는 필요 CLI 불가 Claude Agent only

Tier 3 시:

⚠ [Tier 3] multi 실행 환경 미충족 (consensus 미적용)
  누락: {missing} | 권장: 설치 후 재실행 또는 /tfx-qa --quick

HARD RULES

  1. codex exec 직접 호출 및 deprecated Gemini CLI 직접 호출 금지
  2. Codex/Antigravity → Bash("tfx multi --assign ...") 만. teammate mode는 생략해 auto 기본값을 쓴다.
  3. Claude → Agent(run_in_background=true)
  4. Bash + Agent 동시 호출

모델 역할

CLI 역할 관점
Claude Opus 기능검증 정확성, 엣지케이스, 누락 테스트
Codex 보안+성능 OWASP, O(n²), 메모리, 입력 검증
Antigravity UX+접근성 응답 일관성, 에러 메시지, WCAG

EXECUTION

Step 1: 검증 대상 수집
  1. 지정 경로 → 해당 범위
  2. git diff → 변경 파일
  3. 지정 없음 → 프로젝트 전체
Step 2: 3-CLI 독립 검증 (Anti-Herding) — Bash + Agent 동시 호출

Agent (Claude 기능검증):

Agent(
  subagent_type="oh-my-claudecode:verifier",
  model="opus",
  run_in_background=true,
  name="qa-functional",
  prompt="QA 엔지니어로서 기능 정확성 검증. 테스트 실행 + 엣지 케이스(null, 빈, 경계값, 동시성) + 누락 테스트 제안. JSON: { test_result: {pass,fail,skip}, findings: [...], edge_case_tests: [...], overall_verdict: 'pass'|'fail' }"
)

Codex + Antigravity headless:

Bash("tfx multi --auto-attach --dashboard --assign 'codex:보안/성능 전문가. OWASP Top 10, O(n²), 메모리 누수, 입력 검증 누락. JSON: { findings: [...], overall_verdict: \"pass\"|\"fail\" }:verifier' --assign 'antigravity:UX/접근성 전문가. API 응답 일관성, 에러 메시지, WCAG 2.1 AA, 문서-동작 일치. JSON: { findings: [...], overall_verdict: \"pass\"|\"fail\" }:verifier' --timeout 1800", run_in_background=true)

Read the full file on GitHub · 163 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 9d ago First seen · 163 lines · 67 tokens per session scan A 3abdb48a78eb

Subscribe to this mod's changes

tfx-qa is a skill published in the GitHub repository tellang/triflux (7 stars, last pushed yesterday), licensed MIT. It adds 67 tokens to every session and 1,566 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

done

Run the closeout ritual before handing back non-trivial work; full verification, revert-probe honesty, independent review, and scope reporting. Use before declaring completion, opening a PR, wrapping up a change, or "ปิดงาน".

ohm41321/luciazero · 50 tokens

debug

Debug a stubborn bug with a deterministic reproduction, hypothesis ledger, one-variable fixes, and a regression test. Use after the first obvious look fails, reproduction is unclear, or a fix attempt failed. Not for routine obvious failures; use for "ไล่บั๊ก".

ohm41321/luciazero · 57 tokens

verification-loop

This skill should be used when the user asks to "verify code", "run verification", "check quality", "validate changes", or before creating a PR. Provides comprehensive verification including build, type check, lint, tests, security scan, and diff review.

Galaxy-Dawn/claude-scholar · 55 tokens

sc-skill

Capture deterministic macOS screenshots for testing, docs, release notes, and marketing assets. Use when asked to automate app screenshots, batch-generate screenshot sets, standardize window sizing/composition, or choose between Peekaboo and native macOS screenshot tooling.

jazzyalex/agent-sessions · 55 tokens

agent-session-format-check

Verify agent session format compatibility for Agent Sessions. Use when any agent CLI updates, when monitoring flags drift, or when bumping max verified versions (fixtures + docs + tests). Covers session schema, usage/limits tracking, storage backends, and discovery path contracts for all supported agents.

jazzyalex/agent-sessions · 62 tokens

intuitive-tests

Use this skill whenever the user asks about unit test best practices, test organization, flat test suites, redundant tests, test refactors, pytest/JUnit/Jest/xUnit layout, test taxonomy, flaky tests, coverage quality, fixtures, mocks, parametrization, pruning existing UTs, or "which tests are worth keeping." It…

MiaoDX/intuitive-flow · 154 tokens